Foundations — Issue 43

Practical Mechanism

How Persistent Memory Moves Through an Agent System

By Sevda Polat— August 20, 2026

Feature image for article: How Persistent Memory Moves Through an Agent System

Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice.

Practical Mechanism

How Persistent Memory Moves Through an Agent System

By Sevda Polat— August 20, 2026

Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice.

Threat Model Shift

Memory as a Write Path

By Sevda Polat— August 20, 2026

Feature image for article: Memory as a Write Path

An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer.

Threat Model Shift

Memory as a Write Path

By Sevda Polat— August 20, 2026

An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer.

Reading List

Toward Mnemonic Sovereignty: A Survey on the Security of Long-Term Memory in LLM Agents

The most comprehensive map of how agent memory can be attacked, defended, and governed — dense but worth it.

Defense Effectiveness Across Architectural Layers in Stateful LLM Agents

What actually happens when poisoned retrieval content enters persistent memory and resurfaces in later sessions.

OWASP Top 10 for Agentic AI: The 2026 Cheat Sheet

AI Agent Memory Architectures: From Context Windows to Persistent Knowledge

Rethinking Memory Mechanisms of Foundation Agents: A Survey

AI Memory Security: Best Practices and Implementation

Reading List

Toward Mnemonic Sovereignty: A Survey on the Security of Long-Term Memory in LLM AgentsThe most comprehensive map of how agent memory can be attacked, defended, and governed — dense but worth it.

Defense Effectiveness Across Architectural Layers in Stateful LLM AgentsWhat actually happens when poisoned retrieval content enters persistent memory and resurfaces in later sessions.

Quick links

OWASP Top 10 for Agentic AI: The 2026 Cheat Sheet

AI Agent Memory Architectures: From Context Windows to Persistent Knowledge

Rethinking Memory Mechanisms of Foundation Agents: A Survey

AI Memory Security: Best Practices and Implementation

Memory Types

Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted.

These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break.

Memory Types

Most discussions of agent memory treat it as a single capability: the agent remembers things, or it doesn't. In practice, agents draw on at least five distinct types of stored information, each written through different mechanisms, retrieved differently, and carrying different risks when something goes stale or gets corrupted.

These distinctions matter because each type fails in its own way. A preference that outlives a business relationship causes a different kind of harm than a retrieved document with expired permissions. A learned behavioral pattern reinforcing its own errors degrades differently than a tool-call log pointing at an API that changed its schema last week. Identifying which types you actually rely on is the starting point for understanding what can break.

Session Context

Session Context Disappears When the Window Closes

Messages, tool outputs, reasoning traces: everything in the current context window counts as session context. It's written automatically and visible to the model on every turn. High fidelity while it lasts, but susceptible to injection through any in-window content and to "lost in the middle" degradation as conversations grow long.

Retrieved Documents

Retrieved Documents Arrive Looking Like Trusted Material

External content indexed by embedding similarity, pulled into context on demand through ingestion pipelines and approximate search. Once inside the context window, retrieved content can function like instructions within the model's reasoning. Permission freshness across vector indexes and cached snippets is difficult to maintain.

Persistent Preferences

Persistent Preferences Carry Forward Across Every Session

Durable records of user or organization facts — constraints, settings, profile data — kept in structured key-value or semantic stores. Written by extraction pipelines or by the agent itself through tool calls. The characteristic risk here is staleness with consequence: an outdated preference drives confidently wrong actions, not merely wrong answers.

Learned Patterns

Learned Patterns Shape How Agents Approach Tasks

Distilled behavioral knowledge: rules of thumb, verified workflows, error-avoidance heuristics. Written through deliberate reflection or consolidation steps, making this the most expensive and fragile write path. Retrieved by task similarity. Verification is especially hard because self-reinforcing errors compound quietly over time.

Tool History

Tool-Call History Logs What Actually Happened When

Chronological records of tool invocations: which tool, what parameters, what result. Written automatically at execution time with no retention decision required. This is the most auditable memory type, but logging that something occurred differs from establishing whether the result still holds. Schema drift in fast-moving APIs can silently invalidate stored records.

Write Security

The Write Path Creates a Delayed Attack Surface

Content accepted at write time acquires operational influence later, at retrieval. Researchers demonstrated that triggers embedded in uploaded images entered long-term memory and subsequently redirected agent planning without any new prompt injection, reaching roughly 85% success in a mock e-commerce environment. Memory poisoning is now tracked as a category distinct from prompt injection.

Verification Gaps

Each Memory Type Requires Different Verification Work

Session context is transparent but lossy after compression. Retrieved documents require permission freshness checks across multiple storage layers. Preferences need temporal versioning and contradiction detection. Learned patterns lack any independent evidence chain. Tool-call logs are concrete but meaningless until compared against external system state.

Provenance Gaps

Agent memory systems are reliable at storing and returning text. But the text is only part of what makes stored information trustworthy. At write time, metadata travels alongside it: who produced it, where it came from, whether anyone verified it, when it was recorded, what conditions it applied to.

Between write and retrieval, that metadata gets stripped away. Chunking removes some. Embedding discards more. Consolidation, where multiple entries get merged into compressed summaries, tends to finish the job. What comes back is content without the surrounding context that would tell you whether to trust it or how narrowly to apply it. These are the specific dimensions where that loss occurs.

Provenance Gaps

Agent memory systems are reliable at storing and returning text. But the text is only part of what makes stored information trustworthy. At write time, metadata travels alongside it: who produced it, where it came from, whether anyone verified it, when it was recorded, what conditions it applied to.

Between write and retrieval, that metadata gets stripped away. Chunking removes some. Embedding discards more. Consolidation, where multiple entries get merged into compressed summaries, tends to finish the job. What comes back is content without the surrounding context that would tell you whether to trust it or how narrowly to apply it. These are the specific dimensions where that loss occurs.

Provenance Loss

Source URLs Survive but Derivation Chains Don't

A chunk might carry a document ID or URL as metadata. But once that chunk gets summarized or merged with other content, the link to its origin breaks. Consolidation collapses many sourced entries into a single unsourced summary with no trail back.

Authority Gap

Authority Metadata Survives in Almost No Framework

Who authorized a memory write? Is that permission still current? What trust level does the source carry? In a recent benchmark evaluating 49 consolidator-model combinations, 48 erased these signals during consolidation. Content persists, but the record of who was allowed to write it does not.

Stale State

Timestamps Persist but Freshness Reasoning Mostly Doesn't

A write timestamp can survive if explicitly stored. What doesn't survive is any mechanism to act on it. Standard RAG retrieval returns stale facts 15 to 40 percent of the time when knowledge has evolved. The store has no way to know the world changed.

Verification Absent

No Framework Tracks Whether Content Was Verified

Was this fact cross-validated against a canonical source? Is it an observation, an instruction, or an unconfirmed claim? No mainstream memory substrate treats verification status as a stored field. At retrieval, every entry carries the same apparent credibility regardless of its evidentiary basis.